<p>Anthropic shipped a 59.8MB source map with Claude Code v2.1.88 that exposed 512,000 lines of unobfuscated TypeScript across 1,900 files. Not hacked, not breached — just a missing line in the build config. They pulled the package once they noticed, but not before people had already dug through it.</p>
<p>Here’s what was actually in there.</p>
<h2>The architecture</h2>
<p>Claude Code is built on TypeScript and Bun, and it’s structured less like a CLI tool and more like an agent operating system. There’s a 40+ tool syscall-style permission layer, multi-agent swarm orchestration (behind feature flags), and two unreleased background services:</p>
<ul>
<li><strong>KAIROS</strong> — an autonomous daemon that proactively acts on a schedule</li>
<li><strong>autoDream</strong> — a memory consolidation sub-agent</li>
</ul>
<p>Multi-session tracking uses a sliding window algorithm. There’s also a 2,600-line bash security system specifically for blocking shell injection vectors.</p>
<h2>The weird stuff</h2>
<p>Some of the more interesting finds:</p>
<ul>
<li>Species names in the code are hex-encoded to avoid triggering internal model codename canary checks</li>
<li>Hidden internal commands named <code>goodClaude</code> and <code>ultraplan</code></li>
<li>A TypeScript type literally called <code>I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS</code> — apparently a forcing function to prevent accidental analytics data leaks</li>
<li>A permission mode internally called <code>yoloClassifier.ts</code> that uses ML-based safety decisions</li>
<li>A full hand-rolled Vim keybinding state machine</li>
<li>Medieval-English code comments warning about API thinking block rules</li>
<li>Anti-distillation systems apparently targeting competitors</li>
<li>Silent profanity logging</li>
<li>Evidence of borrowed scroll behavior from the open-source OpenCode project</li>
</ul>
<h2>44 feature flags</h2>
<p>The leak exposed 44 compile-time feature flags hiding finished but unreleased capabilities, including voice mode, ULTRAPLAN, and a Tamagotchi-style companion pet system. The pet system has species, rarity tiers, ASCII art animations, D&amp;D-style stats, and shiny variants — all sitting behind a flag, apparently complete and waiting.</p>
<h2>Internal model codenames</h2>
<p>The code revealed several internal model names: Capybara (Claude 4.6/Mythos), Fennec (Opus 4.6), and an unreleased model called Numbat.</p>
<h2>The legal mess</h2>
<p>Someone built a Python port of the leaked code using OpenAI’s Codex almost immediately. Whether Anthropic can DMCA that port is genuinely unclear — AI-generated code and copyright is still unsettled territory.</p>
<h2>The broader point</h2>
<p>This happened the same week as a supply-chain attack on the Axios npm package, which is either a coincidence or a reminder that build pipelines are now a serious attack surface for AI tooling teams. The Claude Code team has been vocal about moving fast with AI agents. This is what moving fast looks like sometimes — 500,000 lines of internal code exposed because someone forgot to exclude a <code>.map</code> file from the release bundle.</p>
<p>Local builds of Claude Code have reportedly been achieved internally using the leaked source, which is its own kind of irony.</p>


Collections

Anthropic accidentally shipped a 59.8MB source map with Claude Code v2.1.88, exposing 512,000 lines of unobfuscated TypeScript across 1,900 files due to a missing line in the build config. The leak revealed Claude Code's internal architecture — built on TypeScript and Bun — including a 40+ tool permission layer, multi-agent swarm orchestration behind feature flags, and two unreleased background services (KAIROS and autoDream). Also exposed were 44 feature flags hiding finished but unreleased capabilities like voice mode, ULTRAPLAN, and a Tamagotchi-style companion pet system, plus internal model codenames including an unreleased model called Numbat. Notable quirks found in the code include a Vim keybinding state machine, silent profanity logging, anti-distillation systems, and a permission mode called yoloClassifier.ts. The package was pulled after discovery, but not before the community had thoroughly analyzed it and someone built a Python port using OpenAI's Codex.

Anthropic open-sourced Claude Code

<p>It was leaked, not open sourced. They have since retracted the mistake but its too late now. 😂</p>
